[3.2] Release notes #8844

rhr323 · 2025-10-13T17:03:24Z

This PR adds version 3.2.0 to the release notes index.

API reference and 3rd party dependencies have also been added, otherwise the PR checks failed.

prodsecmachine · 2025-10-13T17:03:37Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Licenses	0	0	0	0	0 issues
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

github-actions · 2025-10-13T17:04:19Z

🔍 Preview links for changed docs

docs/release-notes/index.md

docs/release-notes/known-issues.md

docs/release-notes/index.md

barkbay · 2025-10-29T12:49:26Z

docs/release-notes/index.md

+- fix(deps): update all ungrouped dependencies [#8836](https://github.com/elastic/cloud-on-k8s/pull/8836)
+- fix(deps): update all ungrouped dependencies [#8826](https://github.com/elastic/cloud-on-k8s/pull/8826)


This feels less useful now that the updates are grouped. (see the same section for 3.1 as a comparison: https://www.elastic.co/docs/release-notes/cloud-on-k8s#elastic-cloud-kubernetes-310-miscellaneous)

I sorted the dependecies (+ removed some duplicates). But I see your point now, we have lots of dependency updates hidden in PRs like this:

- fix(deps): update all ungrouped dependencies [#8762](https://github.com/elastic/cloud-on-k8s/pull/8762) - fix(deps): update all ungrouped dependencies [#8785](https://github.com/elastic/cloud-on-k8s/pull/8785) - fix(deps): update all ungrouped dependencies [#8809](https://github.com/elastic/cloud-on-k8s/pull/8809) - fix(deps): update all ungrouped dependencies [#8826](https://github.com/elastic/cloud-on-k8s/pull/8826) - fix(deps): update all ungrouped dependencies [#8836](https://github.com/elastic/cloud-on-k8s/pull/8836)

It's not great, but maybe we can still keep it like this. Or should we just remove the updated dependencies section altogether?

Or should we just remove the updated dependencies section altogether?

If the intent is to share which versions have been updated we could use git and grep, something along the lines of:

git diff 3.1 3.2 -- go.mod \ | grep '^+' \ | grep -E '^[+[:space:]]*[a-zA-Z0-9./_-]+[[:space:]]v[0-9]+\.[0-9]+' \ | grep -v '// indirect' \ | sed -E 's/^[+[:space:]]*//'

github.com/KimMachineGun/automemlimit v0.7.4 github.com/gkampitakis/go-snaps v0.5.15 github.com/hashicorp/vault/api v1.22.0 github.com/prometheus/client_golang v1.23.2 github.com/prometheus/common v0.67.1 github.com/spf13/cobra v1.10.1 github.com/spf13/pflag v1.0.10 github.com/spf13/viper v1.21.0 github.com/stretchr/testify v1.11.1 golang.org/x/crypto v0.43.0 k8s.io/api v0.34.1 k8s.io/apimachinery v0.34.1 k8s.io/client-go v0.34.1 k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 sigs.k8s.io/controller-runtime v0.22.2 sigs.k8s.io/controller-tools v0.19.0

(⚠️ tested on Mac, we should maybe try to automate this in the existing tooling)

My concern with a list of update all ungrouped dependencies is that it doesn’t bring much value 😕

👍 , I updated the dependency part with the list of updates (instead of listing the PRs).

Here is an (AI generated/assisted) script that can be used in the future: #8880.

barkbay · 2025-10-30T15:58:35Z

docs/release-notes/index.md

+
+#### User Password Generation (Enterprise feature)
+
+ECK will now generate longer passwords by default for the administrative user of each Elasticsearch cluster. The password is 24 characters in length by default (can be configured to a maximum of 72 characters), incorporating alphabetic and numeric characters, to make password complexity stronger. Refer to the [managed credentialss](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/managed-credentials-eck.md) page for examples and more details.


Suggested change

ECK will now generate longer passwords by default for the administrative user of each Elasticsearch cluster. The password is 24 characters in length by default (can be configured to a maximum of 72 characters), incorporating alphabetic and numeric characters, to make password complexity stronger. Refer to the [managed credentialss](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/managed-credentials-eck.md) page for examples and more details.

ECK will now generate longer passwords by default for the administrative users of each Elasticsearch cluster. The password is 24 characters in length by default (can be configured to a maximum of 72 characters), incorporating alphabetic and numeric characters, to make password complexity stronger. Refer to the [managed credentials](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/managed-credentials-eck.md) page for examples and more details.

barkbay · 2025-10-30T15:58:52Z

docs/release-notes/index.md

+
+#### Automatic pod disruption budget (Enterprise feature)
+
+ECK now offers better out-of-the-box PodDisruptionBudgets that automatically keep your cluster available as Pods move across nodes. The new policy calculates the number of Pods per tier that can sustain replacement and automatically generates a PodDisruptionBudget for each tier, enabling the Elasticsearch cluster to vacate Kubernetes nodes more quickly, while considering cluster health, without interruption. The documentation about [PodDisruptionBudget](docs-content://deploy-manage/deploy/cloud-on-k8s/pod-disruption-budget.md) has more informaiton and details.


Suggested change

ECK now offers better out-of-the-box PodDisruptionBudgets that automatically keep your cluster available as Pods move across nodes. The new policy calculates the number of Pods per tier that can sustain replacement and automatically generates a PodDisruptionBudget for each tier, enabling the Elasticsearch cluster to vacate Kubernetes nodes more quickly, while considering cluster health, without interruption. The documentation about [PodDisruptionBudget](docs-content://deploy-manage/deploy/cloud-on-k8s/pod-disruption-budget.md) has more informaiton and details.

ECK now offers better out-of-the-box PodDisruptionBudgets that automatically keep your cluster available as Pods move across nodes. The new policy calculates the number of Pods per tier that can sustain replacement, and automatically generates a PodDisruptionBudget for each tier. This enables the Elasticsearch cluster to vacate Kubernetes nodes more quickly, while considering cluster health, without interruption. The documentation about [PodDisruptionBudget](docs-content://deploy-manage/deploy/cloud-on-k8s/pod-disruption-budget.md) has more information and details.

barkbay · 2025-10-30T16:00:03Z

docs/release-notes/known-issues.md

+
+:::{dropdown} Elastic Agent fails to start with "cipher: message authentication failed" after re-upgrading to ECK 3.2.0, the CONFIG_PATH for Elastic Agent in Fleet mode was changed to align with the STATE_PATH (tracking [Issue #8819](https://github.com/elastic/cloud-on-k8s/issues/8819).
+
+If you upgrade to 3.2.0, downgrade to a previous version (like 3.1.0), and then upgrade back to 3.2.0, the Elastic Agent pods may fail to start. This occurs because the agent, using the new CONFIG_PATH, is unable to decrypt the existing state files encrypted with keys from the old path.


Suggested change

If you upgrade to 3.2.0, downgrade to a previous version (like 3.1.0), and then upgrade back to 3.2.0, the Elastic Agent pods may fail to start. This occurs because the agent, using the new CONFIG_PATH, is unable to decrypt the existing state files encrypted with keys from the old path.

If you upgrade to 3.2.0, downgrade to a previous version (like 3.1.0), and then upgrade back to 3.2.0, the Elastic Agent Pods may fail to start. This occurs because the agent, using the new CONFIG_PATH, is unable to decrypt the existing state files encrypted with keys from the old path.

barkbay · 2025-10-30T16:02:32Z

docs/release-notes/known-issues.md


+## 3.2.0 [elastic-cloud-kubernetes-320-known-issues]
+
+:::{dropdown} Elastic Agent fails to start with "cipher: message authentication failed" after re-upgrading to ECK 3.2.0, the CONFIG_PATH for Elastic Agent in Fleet mode was changed to align with the STATE_PATH (tracking [Issue #8819](https://github.com/elastic/cloud-on-k8s/issues/8819).


I think this is not rendered as expected:

barkbay · 2025-10-30T16:08:41Z

docs/release-notes/index.md

+
+### Release Highlights
+
+#### Automatic pod disruption budget (Enterprise feature)


If think we already have automatic PDBs.

Suggested change

#### Automatic pod disruption budget (Enterprise feature)

#### Advanced PodDisruptionBudget management (Enterprise feature)

barkbay · 2025-10-30T16:15:32Z

docs/release-notes/index.md

+
+#### User Password Generation (Enterprise feature)
+
+ECK will now generate longer passwords by default for the administrative user of each Elasticsearch cluster. The password is 24 characters in length by default (can be configured to a maximum of 72 characters), incorporating alphabetic and numeric characters, to make password complexity stronger. Refer to the [managed credentialss](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/managed-credentials-eck.md) page for examples and more details.


ECK will now generate longer passwords by default

Did we actually change the default length? I think what is new is that this default length can be changed.

barkbay · 2025-10-30T16:17:14Z

docs/release-notes/index.md

+### Miscellaneous  [elastic-cloud-kubernetes-320-miscellaneous]
+
+:::{dropdown} Updated dependencies
+- github.com/gkampitakis/go-snaps v0.5.13 => v0.5.15


I think one small issue here is that we no longer mention which Go version we upgraded to.

Good point! I have updated the script to include go version changes. Looks like both 3.1 and 3.2 is with go 1.24.5.

I think 3.2 has been built with 1.25.2

cloud-on-k8s/build/Dockerfile

Line 2 in a250b82

FROM docker.elastic.co/wolfi/go:1.25.2-r0@sha256:e7ae2baca94c7724545f8a9d2e1cdf2ddbcfa78871f26a7e96bb385f95f97a6d as builder

I quickly tried to update our existing tooling in #8890

pebrc

LGTM

* draft release notes * added draft release highlights * reference docs added * release notes regenerated * highlights updated * added known issue * removed newline * updated dependency updates section * link to documentation from release highlights * pr titles updated * dependency list updated * review comments * title for the agent known issue * password feature description updated (cherry picked from commit 45b74f1)

rhr323 · 2025-10-30T19:32:39Z

💚 All backports created successfully

Status	Branch	Result
✅	3.2

Questions ?

Please refer to the Backport tool documentation

* draft release notes * added draft release highlights * reference docs added * release notes regenerated * highlights updated * added known issue * removed newline * updated dependency updates section * link to documentation from release highlights * pr titles updated * dependency list updated * review comments * title for the agent known issue * password feature description updated (cherry picked from commit 45b74f1)

draft release notes

2ad08f6

rhr323 added >docs Documentation exclude-from-release-notes Exclude this PR from appearing in the release notes v3.2.0 labels Oct 13, 2025

added draft release highlights

c766ac5

pebrc reviewed Oct 15, 2025

View reviewed changes

docs/release-notes/index.md Outdated Show resolved Hide resolved

docs/release-notes/index.md Outdated Show resolved Hide resolved

rhr323 added 3 commits October 17, 2025 23:04

reference docs added

8745674

release notes regenerated

9e9850c

highlights updated

7241ba3

rhr323 commented Oct 27, 2025

View reviewed changes

docs/release-notes/known-issues.md Outdated Show resolved Hide resolved

rhr323 marked this pull request as ready for review October 27, 2025 23:11

added known issue

1796843

rhr323 changed the title ~~[3.2] Add release notes~~ [3.2] Release notes Oct 28, 2025

removed newline

13e96ab

barkbay reviewed Oct 29, 2025

View reviewed changes

docs/release-notes/index.md Outdated Show resolved Hide resolved

docs/release-notes/index.md Show resolved Hide resolved

barkbay reviewed Oct 29, 2025

View reviewed changes

docs/release-notes/index.md Outdated Show resolved Hide resolved

barkbay reviewed Oct 29, 2025

View reviewed changes

docs/release-notes/index.md Outdated Show resolved Hide resolved

barkbay reviewed Oct 29, 2025

View reviewed changes

rhr323 added 4 commits October 29, 2025 15:49

updated dependency updates section

1e703db

link to documentation from release highlights

0bc08b4

pr titles updated

d2403be

dependency list updated

3365d56

barkbay reviewed Oct 30, 2025

View reviewed changes

review comments

8b4c67f

rhr323 added 2 commits October 30, 2025 17:33

title for the agent known issue

4f4abfa

password feature description updated

0353709

pebrc approved these changes Oct 30, 2025

View reviewed changes

rhr323 merged commit 45b74f1 into elastic:main Oct 30, 2025
9 checks passed

rhr323 deleted the release-notes-3.2.0 branch October 30, 2025 19:31

rhr323 mentioned this pull request Oct 30, 2025

[3.2] [3.2] Release notes (#8844) #8882

Merged

		- fix(deps): update all ungrouped dependencies [#8836](https://github.com/elastic/cloud-on-k8s/pull/8836)
		- fix(deps): update all ungrouped dependencies [#8826](https://github.com/elastic/cloud-on-k8s/pull/8826)


		#### User Password Generation (Enterprise feature)

		ECK will now generate longer passwords by default for the administrative user of each Elasticsearch cluster. The password is 24 characters in length by default (can be configured to a maximum of 72 characters), incorporating alphabetic and numeric characters, to make password complexity stronger. Refer to the [managed credentialss](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/managed-credentials-eck.md) page for examples and more details.


		#### Automatic pod disruption budget (Enterprise feature)

		ECK now offers better out-of-the-box PodDisruptionBudgets that automatically keep your cluster available as Pods move across nodes. The new policy calculates the number of Pods per tier that can sustain replacement and automatically generates a PodDisruptionBudget for each tier, enabling the Elasticsearch cluster to vacate Kubernetes nodes more quickly, while considering cluster health, without interruption. The documentation about [PodDisruptionBudget](docs-content://deploy-manage/deploy/cloud-on-k8s/pod-disruption-budget.md) has more informaiton and details.


		:::{dropdown} Elastic Agent fails to start with "cipher: message authentication failed" after re-upgrading to ECK 3.2.0, the CONFIG_PATH for Elastic Agent in Fleet mode was changed to align with the STATE_PATH (tracking [Issue #8819](https://github.com/elastic/cloud-on-k8s/issues/8819).

		If you upgrade to 3.2.0, downgrade to a previous version (like 3.1.0), and then upgrade back to 3.2.0, the Elastic Agent pods may fail to start. This occurs because the agent, using the new CONFIG_PATH, is unable to decrypt the existing state files encrypted with keys from the old path.


		## 3.2.0 [elastic-cloud-kubernetes-320-known-issues]

		:::{dropdown} Elastic Agent fails to start with "cipher: message authentication failed" after re-upgrading to ECK 3.2.0, the CONFIG_PATH for Elastic Agent in Fleet mode was changed to align with the STATE_PATH (tracking [Issue #8819](https://github.com/elastic/cloud-on-k8s/issues/8819).


		### Release Highlights

		#### Automatic pod disruption budget (Enterprise feature)

	#### Automatic pod disruption budget (Enterprise feature)
	#### Advanced PodDisruptionBudget management (Enterprise feature)

[3.2] Release notes #8844

[3.2] Release notes #8844

Uh oh!

Conversation

rhr323 commented Oct 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

prodsecmachine commented Oct 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

github-actions bot commented Oct 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Preview links for changed docs

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

barkbay Oct 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

barkbay Oct 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

barkbay Oct 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pebrc left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

rhr323 commented Oct 30, 2025

💚 All backports created successfully

Questions ?

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

rhr323 commented Oct 13, 2025 •

edited

Loading

prodsecmachine commented Oct 13, 2025 •

edited

Loading

github-actions bot commented Oct 13, 2025 •

edited

Loading

barkbay Oct 30, 2025 •

edited

Loading

barkbay Oct 30, 2025 •

edited

Loading

barkbay Oct 30, 2025 •

edited

Loading